CVE-2026-61371: Microsoft AVML Path Traversal Vulnerability

CVE-2026-61371 Overview

CVE-2026-61371 is a symlink following vulnerability in Microsoft AVML (Acquire Volatile Memory for Linux) versions prior to 0.17.0. The tool follows symbolic links when opening the destination output path on Unix systems. This allows an attacker to truncate or overwrite arbitrary files that the AVML process can access. The destructive operation occurs at open-time through the O_TRUNC flag before input validation completes, a pattern known as truncation-before-validation. The flaw is classified under [CWE-59] Improper Link Resolution Before File Access.

Critical Impact
An attacker with local file system access can leverage a pre-placed symlink to force AVML to truncate arbitrary files during memory acquisition, corrupting system state or destroying forensic evidence.

Affected Products

Microsoft AVML versions prior to 0.17.0
Linux memory acquisition workflows using AVML
Digital forensics and incident response tooling built on AVML

Discovery Timeline

2026-07-15 - CVE CVE-2026-61371 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61371

Vulnerability Analysis

AVML is a memory acquisition utility maintained by Microsoft for Linux forensic capture. The vulnerability resides in how AVML opens the user-supplied destination output path. On Unix systems, the tool opens the target path using flags that include O_TRUNC without first resolving whether the path is a symbolic link. When AVML follows the symlink, it truncates the linked target file to zero length before any validation of the destination completes.

The issue is compounded because truncation happens at open-time. The destructive side effect executes before AVML determines whether the path is safe to use. An attacker with local write access to a directory that AVML operates in can plant a symlink pointing to a sensitive file such as /etc/shadow, an audit log, or a forensic artifact.

Root Cause

The root cause is missing symlink resolution and validation prior to opening the destination file with truncation flags. The code path invokes an open() call that does not include O_NOFOLLOW, and does not perform lstat() checks against the final path component before writing. This pattern qualifies as a Time-of-Check Time-of-Use (TOCTOU) related weakness under [CWE-59].

Attack Vector

An attacker who can influence the destination path parameter or place a symlink at a predictable output location can weaponize this flaw. When a privileged user or automated forensics workflow invokes AVML, the tool follows the symlink and truncates the target. The vulnerability requires no authentication to AVML itself, but the attacker needs the ability to create a symlink at the output path location.

The exploitation scenario proceeds in three steps. First, the attacker identifies or predicts the destination output path AVML will write to. Second, the attacker creates a symlink at that path pointing to a target file they wish to destroy. Third, when AVML runs, the O_TRUNC open call truncates the symlink target to zero bytes.

A proof-of-concept demonstrating the symlink truncation behavior is available in the GitHub Gist PoC Repository and discussed in the GitHub Pull Request Discussion.

Detection Methods for CVE-2026-61371

Indicators of Compromise

Unexpected zero-byte files at locations where AVML output paths overlap with sensitive system files
Symbolic links present in directories used as AVML output targets prior to execution
Audit log entries showing open() syscalls from the AVML binary with O_TRUNC against non-image files
File integrity monitoring alerts on truncation of system files coinciding with AVML invocations

Detection Strategies

Monitor process execution of AVML binaries and correlate with file write and truncate events on unexpected paths
Deploy Linux auditd rules that watch for openat syscalls including O_TRUNC from forensic tooling directories
Use file integrity monitoring to detect unexpected zero-byte truncation events on sensitive files such as /etc/shadow, /var/log/*, and audit databases

Monitoring Recommendations

Establish baselines for AVML output path conventions and alert on deviations that write outside approved directories
Track version strings of deployed AVML binaries across fleet inventory to identify hosts running versions before 0.17.0
Log all forensic acquisition workflows in a centralized SIEM to correlate AVML activity with subsequent file system changes

How to Mitigate CVE-2026-61371

Immediate Actions Required

Upgrade all deployments of Microsoft AVML to version 0.17.0 or later
Audit incident response and forensic acquisition scripts to confirm they invoke the patched AVML binary
Restrict write access on directories used as AVML output destinations to prevent attacker-controlled symlink placement
Run AVML only from trusted output directories owned by the invoking user with no world-writable permissions

Patch Information

Microsoft addressed the vulnerability in AVML version 0.17.0. The release notes are available at the GitHub Release Notes v0.17.0. The fix is discussed in the GitHub Pull Request Discussion, which introduces symlink-safe file opening semantics. Upgrade all forensic tooling that bundles or invokes AVML.

Workarounds

Direct AVML output to a freshly created directory owned by root with mode 0700 for each acquisition run
Validate that the destination path is not a symbolic link using lstat in wrapper scripts before invoking AVML
Confine AVML execution using mandatory access controls such as AppArmor or SELinux profiles that restrict writable paths

bash

# Configuration example: safe AVML invocation wrapper
OUTDIR=$(mktemp -d -p /var/forensics avml.XXXXXX)
chmod 700 "$OUTDIR"
OUTFILE="$OUTDIR/memory.lime"
if [ -L "$OUTFILE" ]; then
  echo "Refusing to write: destination is a symlink" >&2
  exit 1
fi
avml "$OUTFILE"